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Abstract 

The  purpose  of  this  research  was  to  examine  the  impact  of  HIPAA  compliance  on  the 
Battlefield  Medical  Evacuation  process.  Specifically,  this  thesis  sought  to  answer  three 
research  questions  addressing  the  current  Battlefield  Medical  Evacuation  process  and 
current  HIPAA  considerations  for  each  step  of  the  process.  The  research  questions  were 
answered  through  the  use  of  the  Delphi  Technique.  Eight  experts,  representing  Air  Force, 
Army  and  Civilian  medical  communities  participated  in  two  rounds  of  the  Delphi 
Technique.  The  research  identified  how  HIPAA  compliance  is  handled  now  and 
identified  suggested  improvements. 

An  original  model  of  the  battlefield  medical  evacuation  process  was  developed,  and  this 
was  presented  to  the  Delphi  group  for  changes  and  acceptance.  The  group  was  then 
tasked  to  identify  the  application  of  the  HIPPA  requirements  at  each  stage  of  the  model. 
The  final  model  suggests  that  partial  HIPAA  compliance  is  the  current  trend  in  the  early 
steps  of  battlefield  medical  evacuation.  The  culmination  of  this  effort  was  the 
development  of  recommended  improvements  based  upon  the  suggestions  of 
knowledgeable  people.  The  suggested  improvements  were:  clear  guidance,  training  and 
additional  resources. 

The  study  may  help  Commanders  prepare  themselves  and  their  personnel  to  handle 
HIPAA  information  in  a  deployed  environment. 


IV 


Acknowledgments 


I  would  like  to  express  my  sincere  appreciation  to  my  faculty  advisor,  Dr  Alan  Heminger, 
for  his  guidance  and  support  throughout  the  course  of  this  thesis  effort.  The  insight  and 
experience  were  certainly  appreciated.  I  would  also  like  to  thank  the  members  of  the 
Wright  Patterson  Medical  Center  who  so  generously  donated  their  time  to  this  study. 
Finally,  I  would  like  to  thank  my  wife  for  her  love  and  support  without  which  I  could  not 
have  accomplished  this. 


John  A.  Chessman 


Table  of  Contents 


Page 

Abstract . iv 

Acknowledgments . v 

Table  of  Contents . vi 

List  of  Figures . viii 

I.  Introduction . 1 

Overview . 1 

Background . 2 

Need  for  Solution . 3 

Problem  to  be  researched . 4 

Scope/  Methodology . 5 

Anticipated  Results . 5 

II.  Literature  Review . 6 

Introduction . 6 

Background . 7 

Security  Rule . 8 

Privacy  Rule . 9 

HIPAA  Impact . 9 

Summary . 1 1 

III.  Methodology . 13 

Overview . 13 

Delphi  Method . 13 

Initial  Model . 14 

Panel  Selection . 14 

Delphi  Research  Protocol . 15 

Round  One . 16 

Round  Two . 17 

Summary . 18 

IV.  Findings  and  Analysis . 19 

Overview . 19 


vi 


Page 


Summary  of  Results . 19 

Summary . 28 

V.  Conclusions  and  Recommendations . 29 

Discussion . 29 

Conclusions . 33 

Limitations . 33 

Recommendations  for  Future  Research . 34 

Bibliography . 36 


vii 


List  of  Figures 


Page 

Figure  1 .  Initial  Model . 21 

Figure  2.  Round  Two  Model  2a  "Full  Compliance" . 22 

Figure  3.  Round  Two  Model  2b  "Partial  Compliance" . 23 

Figure  4.  Afghanistan  Model . 25 

Figure  5.  Final  Model . 27 


viii 


A  DELPHI  STUDY  OF  HIPAA  COMPLIANCE  TO  BATTLEFIELD  MEDICAL 


EVACUATION 


I.  Introduction 


Overview 

The  Health  Insurance  Portability  and  Accountability  Act  (HIPAA)  of  1996, 

Public  Law  104-191,  was  enacted  on  August  21,  1996,  and  went  into  effect  on  April  14, 
2003.  HIPAA  was  intended  to  protect  the  health  insurance  coverage  for  working 
families  when  they  changed  or  lost  their  jobs,  guard  against  fraud,  waste,  and  abuse,  and 
establish  specific  requirements  for  administrative  simplification  in  the  exchange  of 
electronic  health  data  among  employers,  insurers,  and  providers  (Antognini,  2002,  p296). 
The  Military  Health  System  is  considered  a  health  plan  under  HIPAA  law  and  is 
obligated  to  comply  with  all  HIPAA  regulations  (Butler,  2002).  The  battlefield  is  a 
uniquely  military  environment  in  which  time  is  of  the  essence,  and  the  extra  burdens 
imposed  by  HIPAA  compliance  could  impact  the  survival  of  military  wounded. 

The  purpose  of  this  study  is  to  examine  the  implementation  of  HIPAA  on 
battlefield  medical  treatment  to  determine  where  it  makes  sense  for  battlefield  medical 
teams  to  comply  with  HIPAA  regulations  when  treating  military  wounded.  HIPAA 
administration  simplification  is  supposed  to  significantly  reduce  the  costs  of  processing 
and  handling  patient  health  information  (Hannan,  2005).  Has  the  desired  effect  been 
realized  in  battlefield  medical  treatment  or  is  the  opposite  true?  The  purpose  of  this 
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chapter  is  to  introduce  HIPAA,  discuss  the  basic  background,  and  describe  the  problem  to 
be  investigated  and  the  methodology  to  be  used. 

Background 

HIPAA  has  three  main  parts:  (1)  Insurance  Portability,  (2)  Preventing  Health 
Care  Fraud  and  Abuse,  and  (3)  Administrative  Simplification  (Office  for  Civil  Rights, 
2006).  This  study  will  address  only  the  Administrative  Simplification  section  of  HIPAA. 
Administrative  Simplification  is  intended  to  protect  access  to  patient  protected  health 
information  (PHI)  and  improve  the  efficiency  and  effectiveness  of  the  health  care  system 
by  standardizing  electronic  data  exchange.  HIPAA  requires  appropriate  technical, 
administrative  and  physical  safeguards  to  protect  the  privacy  of  health  information. 
HIPAA  is  designed  to  standardize  the  handling  of  PHI  and  to  promote  data  standards  for 
the  electronic  exchange  of  medical  information  (Office  for  Civil  Rights,  2006). 

HIPAA  Administration  Simplification  implementation  is  guided  by  two  formal 
rules:  the  Security  Rule  and  the  Privacy  Rule.  The  Security  Rule  describes  the  standards 
for  the  security  of  electronic  PHI  in  any  electronic  medium  (Health  and  Human  Services, 
2003).  The  Privacy  Rule  protects  all  individually  identifiable  health  information  records 
held  or  transmitted  by  a  covered  entity  and  specifies  who  can  access  the  patient 
information  (Office  for  Civil  Rights,  2002;  Leahy,  1997).  The  Privacy  Act  of  1974  and 
HIPAA  Privacy  Rule  have  very  similar  requirements.  The  Security  and  Privacy  rules  are 
the  basis  for  handling  and  transmitting  protected  health  infonnation  in  all  mediums 
(Wolfowitz,  2002). 
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The  active  duty  Military  Health  System  HIPAA  is  specifically  mentioned  in  the 
law.  All  Military  Treatment  Facilities  must  comply  with  the  HIPAA  regulations.  The 
Department  of  Defense  (DoD)  position  is  that  HIPAA  also  applies  to  battlefield  medical 
treatment  (Ash,  2006).  The  law  does  permit  exceptions  to  support  unique  military 
requirements  such  as  infonnation  crucial  to  force  health  readiness.  HIPAA  places 
additional  administrative  burdens  on  deploying  medical  forces  (Butler,  2002).  Additional 
administrative  personnel  are  required  to  process  the  extra  requirements  and  properly 
protect  the  information.  The  forms,  paper,  and  processing  equipment  required  take  up 
precious  pallet  space  on  military  airlift.  For  these  reasons  alone,  the  Air  Force  medical 
community  has  requested  waivers  to  HIPAA  compliance  (Greentree,  2004;  Ash,  2006). 

Need  for  Solution 

When  HIPAA  was  written,  Congress  made  it  clear  that  HIPAA  applies  to  the 
DoD.  By  specifically  including  the  Military  Health  System,  Congress  left  no  doubt  that  it 
intended  for  the  military  to  be  included  in  HIPAA  compliance.  It  did  not  foresee  all  of 
the  impact  of  the  HIPAA  regulations  on  military  operations.  For  example,  any 
information  about  battlefield  casualties  which  could  lead  to  the  identification  of  a  specific 
member  is  prohibited  from  public  release.  This  has  implications  for  family  members’ 
ability  to  get  a  status  update  and  even  state  governors  and  members  of  congress  ability  to 
obtain  casualty  information  for  their  districts.  Senator  Ted  Kennedy,  one  of  the  sponsors 
of  the  HIPAA  bill,  has  publicly  said  it  was  not  his  intent  to  block  battlefield  casualty 
information  from  being  released  when  HIPAA  was  written.  Yet  this  is  one  of  the 
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unintended  consequences  of  the  HIPAA  law  (Williams,  2004).  It  does  not  make  sense 
for  HIPAA  to  completely  apply  to  battlefield  wounded  at  all  stages  of  the  treatment 
process  and  has  led  to  confusion  as  to  where  it  should  take  effect.  At  some  point 
between  being  wounded  and  arriving  back  in  the  United  States  for  treatment  the  HIPAA 
requirements  take  effect. 

Problem  to  be  researched 

From  the  above  information  the  following  research  question  has  evolved  to  be 
answered  by  this  study: 

Where  does  it  make  sense  for  HIPAA  regulations  to  take  effect  for  battlefield 
wounded? 

To  fully  investigate  this  research  question,  the  following  investigative  questions  must  be 
answered: 

1 .  What  is  the  current  Battlefield  Medical  Evacuation  Model  and  what  are  the 
current  HIPAA  considerations  for  battlefield  wounded  at  each  step  of  the 
battlefield  evacuation  model? 

2.  What  are  the  recommended  suggestions  for  improvement  to  HIPAA 
compliance  to  the  Battlefield  Medical  Evacuation  model? 

In  order  to  fully  answer  the  investigative  questions  and  ultimately  the  research  problem, 
the  following  research  tasks  were  identified: 

1 .  Develop  a  model  of  current  DoD  standards  for  battlefield  HIPAA  compliance 

2.  Confirm  accuracy  of  battlefield  evacuation  model  with  panel  of  experts 
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3.  Ask  panel  of  expert  for  recommendations  for  improvement  to  HIPAA 
compliance  to  the  battlefield  evacuation  model 
Accomplishing  the  above  research  tasks  and  answering  the  appropriate  questions  helped 
determine  where  it  makes  sense  for  HIPAA  to  take  effect  for  battlefield  wounded.  The 
next  section  will  cover  the  methodology  to  be  used  to  accomplish  these  tasks. 

Scope/  Methodology 

The  study  was  limited  to  HIPAA  compliance  during  the  battlefield  evacuation 
process.  This  study  used  a  Delphi  Study  to  address  the  research  problem.  Interviews  with 
medical  personnel  were  part  of  the  initial  study  to  help  determine  the  questions  for  the 
Delphi  Study. 

Anticipated  Results 

The  possible  findings  of  this  research  may  provide  a  solution  recommended  by 
experts  of  where  HIPAA  should  take  effect  and  provide  a  possible  reference  for  future 
decisions  on  DoD  and  Air  Force  HIPAA  compliance. 
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II.  Literature  Review 


Introduction 

The  Health  Insurance  Portability  and  Accountability  Act  (HIPAA)  was  intended 
to  protect  the  availability  of  health  insurance  for  working  families  and  their  children 
when  they  changed  or  lost  their  jobs,  protect  against  fraud  and  abuse,  and  establish 
specific  requirements  for  administrative  simplification  in  the  exchange  of  electronic 
health  data  among  employers,  insurers,  and  providers.  HIPAA  is  designed  to  standardize 
the  transfer  of  patient  protected  health  infonnation  (PHI)  and  to  promote  data  standards 
for  the  electronic  exchange  of  medical  infonnation  (Antognini,  2002,  p296).  The 
Military  Health  System  is  considered  a  health  plan  and  is  obligated  to  comply  with  all 
requirements  of  HIPAA  as  if  it  were  a  civilian  healthcare  plan.  HIPAA  makes 
allowances  for  the  unique  circumstances  of  military  operations  with  limited  exceptions  to 
meet  unique  military  requirements,  but  leaves  the  details  to  the  DoD  to  work  out  (Butler, 
2002). 

The  purpose  of  this  study  is  to  examine  the  impact  of  HIPAA  on  battlefield 
medical  treatment  to  determine  where  it  makes  sense  for  battlefield  medical  teams  to 
comply  with  the  full  HIPAA  regulations  when  treating  military  wounded.  The  purpose  of 
this  chapter  is  to  expand  upon  the  information  presented  in  Chapter  1  through  relevant 
literature.  First,  a  background  of  HIPAA  will  be  discussed.  Then,  the  Security  and 
Privacy  rules  will  be  explained.  Finally,  the  impact  of  HIPAA  compliance  to  the  Military 
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Health  System  will  be  addressed  to  provide  a  basic  understanding  of  the  requirements 
HIPAA  places  on  military  medical  organizations  when  handing  patient  information. 

Background 

Public  Law  104-191,  The  Health  Insurance  Portability  and  Accountability  Act 
(HIPAA)  was  signed  into  law  by  President  Clinton  on  August  21,  1996.  HIPAA  protects 
individuals  from  losing  their  health  coverage  when  changing  jobs  (Portability)  and  it 
increases  the  federal  government’s  authority  over  medical  fraud  and  abuse 
(Accountability)  (Harman,  2005).  The  HIPAA  law  lists  the  Military  Health  System  as  a 
Health  Plan,  which  is  a  covered  entity  under  HIPAA  and  subject  to  the  HIPAA 
regulations  (Butler,  2002).  Covered  entities  are  health  care  providers,  health  plans,  and 
health  care  clearinghouses  required  to  protect  individually  identifiable  health  information. 
Protected  health  information  (PHI)  is  individually  identifiable  health  information  relating 
to  an  individual's  past,  present,  or  future  physical  or  mental  health  condition,  provision  of 
health  care,  or  payment  for  the  provision  of  health  care  (Antognini,  2001). 

To  improve  the  efficiency  and  effectiveness  of  the  health  care  system,  Congress 
included  Administrative  Simplification  provisions  into  HIPAA  (Office  of  Civil  Rights, 
2006).  Sections  261  through  264  require  the  Secretary  of  the  Department  of  Health  and 
Human  Services  (HHS)  to  publish  national  standards  for  the  electronic  exchange,  privacy 
and  security  of  electronic  health  care  infonnation  transactions  between  covered  entities 
and  these  together  are  known  as  the  Administrative  Simplification  provisions  (Office  of 
Civil  Rights,  2006).  Congress  recognized  the  pace  of  electronic  technology  advances 
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would  endanger  the  security  and  privacy  of  health  information.  (Leahy,  1997).  To  meet 
this  need.  Congress  included  provisions  in  HIPAA  that  mandated  federal  privacy 
protections  for  individually  identifiable  health  information  (Butler,  2002).  Another  goal 
of  HIPAA  was  the  development  of  the  electronic  health  record,  or  the  electronic  medical 
record  as  it  is  commonly  referred  to.  Electronic  medical  records  help  reduce  the 
administrative  costs  of  updating,  storing,  and  protecting  health  records.  The  HIPAA 
Administrative  Simplification  provisions  are  guided  by  two  rules:  the  Security  Rule  and 
the  Privacy  Rule  (Office  of  Civil  Rights,  2006 

Security  Rule 

The  Administrative  Simplification  provisions  of  HIPAA  required  the  Department 
of  Health  and  Human  Services  to  establish  national  standards  for  the  security  of 
electronic  health  care  information.  The  Health  Insurance  Reform:  Security  Standards, 
better  known  as  the  Security  Rule,  describes  the  standards  for  the  security  of  electronic 
protected  health  information  (EPHI),  The  Security  Rule  was  published  in  the  Federal 
Register  on  February  20,  2003,  and  final  compliance  took  effect  on  April  21,  2006.  The 
Security  Rule  has  three  subsections:  Administrative,  Physical,  and  Technical. 
Administrative  safeguards  are  policies  and  procedures  to  clearly  demonstrate  how  the 
entity  will  comply  with  HIPAA,  and  include  written  privacy  policies  and  the  designation 
of  a  Privacy  Officer.  Physical  safeguards  control  physical  access  to  protected  health 
information  to  avoid  unauthorized  access  to  protected  data.  Technical  safeguards  control 
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access  to  computer  systems  and  protect  PHI  transmitted  over  open  networks  from  being 
intercepted  (Health  and  Human  Services,  2003). 

Privacy  Rule 

HIPAA  required  the  Secretary  of  HHS  to  issue  privacy  regulations  covering  PHI 
within  three  years  of  passing  if  Congress  did  not  enact  Privacy  Legislation.  In  1999,  Health 
and  Human  Services  (HHS)  published  the  Standards  for  Privacy  of  Individually  Identifiable 
Health  Information ,  or  the  Privacy  Rule,  and  it  went  into  effect  on  April  14,  2003.  The 
Privacy  Rule  protects  all  individually  identifiable  health  information  held  or  transmitted  by  a 
covered  entity.  Unlike  the  Security  Rule,  the  Privacy  Rule  is  not  limited  to  PHI  in  electronic 
format.  It  covers  all  PHI  information  in  any  format  to  include:  electronic,  written,  or  oral 
form.  The  Privacy  Rule  applies  to  health  plans,  health  care  clearinghouses,  and  to  any  health 
care  provider  who  transmits  health  information  in  electronic  form  (Office  of  Civil  Rights, 
2002). 

The  Privacy  Rule  gives  patients  more  control  over  their  medical  records.  Patients 
have  the  right  to  see  their  records,  the  right  to  request  corrections  to  the  record,  and  the  right 
to  restrict  its  use  for  certain  purposes.  The  privacy  rule  also  requires  that  covered  entities 
provide  their  privacy  policies  to  their  patients  on  their  first  visit.  The  HHS  Office  for  Civil 
Rights  is  charged  with  enforcing  the  Privacy  Rule  (Office  of  Civil  Rights,  2002). 

HIPAA  Impact 

The  Floyd  D.  Spence  National  Defense  Authorization  Act  for  Fiscal  Year  2001 
required  the  DoD  to  develop  regulations  to  improve  the  privacy  protections  of  DoD 
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medical  records.  The  Act  required  a  comprehensive  plan  be  submitted  to  Congress  to 
improve  medical  record  privacy  protection.  The  Act  also  required  the  plan  to  be 
consistent  with  the  soon-to-be-implemented  HIPAA  requirements  (Wolfowitz,  2002). 

The  Act  passed  during  the  interim  period  after  HIPAA  passed  and  before  the  Security  and 
Privacy  rules  went  in  to  full  effect  on  14  April  2003.  The  Authorization  Act  shows 
Congress’s  detennination  to  protect  the  privacy  of  all  Health  information  regardless  of 
the  entity. 

The  Military  Health  System  is  considered  a  health  plan  under  HIPAA  and  must 
comply  with  the  requirements  of  HIPAA  as  if  it  were  a  civilian  healthcare  plan  (Butler, 
2002).  HIPAA  does  make  certain  limited  exceptions  to  meet  unique  military 
requirements,  such  as  the  transfer  of  medical  information  about  active  duty  force  health 
readiness  (Butler,  2002).  Compliance  to  the  HIPAA  provisions  has  required  and  will 
continue  to  require  considerable  resources  from  the  DoD.  Full  compliance  with  all 
sections  of  HIPAA  is  expected  to  cost  over  $100  million  (Williams,  2004). 

Under  the  HIPAA  privacy  rules,  individually  identifiable  health  information  is 
not  allowed  to  be  publicly  reported  without  the  express  permission  of  the  patient  or  next 
of  kin.  It  is  possible  that  if  a  service  member  has  not  authorized  the  release  of  his  or  her 
PHI,  then  not  even  family  members  are  authorized  to  receive  medical  updates  (Williams, 
2004).  HIPAA  regulations  make  tracking  casualty  information  difficult  even  for  state 
governors  and  members  of  congress  (Ash,  2006;  Williams,  2004). 

Literature  relating  directly  to  HIPAA  on  the  battlefield  is  almost  non-existent. 
Most  information  relating  to  active  duty  health  is  focused  on  the  Military  Treatment 
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Centers  in  the  United  States  and  established  bases  overseas,  where  the  normal  HIPAA 
requirements  are  identical  to  those  of  civilian  facilities.  There  are  indications  that  the 
HIPAA  requirements  put  an  enormous  burden  on  deployed  medical  teams.  A  2004 
position  paper  by  Maj  Greentree  AF/SGMA  suggested  the  HIPAA  requirements  detract 
from  the  primary  medical  mission  of  treating  and  evacuating  patients.  HIPAA  would 
require  extra  administrative  personnel  and  supplies  be  transported  on  already  crowded 
airlift  assets.  The  position  paper  recommended  excluding  Air  Force  Medical  Service 
deployed  units  and  operating  forces  from  HIPAA  compliance  while  in  theater  (Greentree, 
2004). 

The  literature  is  clear  that  the  military  is  required  by  law  to  comply  with  HIPAA 
regulations  under  normal  day  to  day  operations.  Congress  included  the  Military  Health 
System  in  the  language  of  the  HIPAA  law  to  ensure  it  was  covered.  Given  the  demands 
of  the  myriad  of  privacy  regulations  the  military  must  adhere  to  and  the  exemptions 
allowed  under  HIPAA,  it  is  not  clear  when  real  world  enforcement  makes  sense  in  a 
combat  theater  of  operations.  If  the  question  is  asked  of  the  military  medical  community, 
the  quick  answer  will  likely  be,  “It  applies  everywhere.”  The  reality  of  enforcement  in  a 
theater  of  active  combat  operations  may  be  vastly  different. 

Summary 

This  chapter  looked  at  the  literature  to  explain  the  background  of  HIPAA 
followed  with  a  discussion  of  the  major  components  which  affect  the  DoD;  the  Security 
Rule  and  the  Privacy  Rule.  The  chapter  concluded  with  a  discussion  of  the  impact  of 


11 


HIPAA  compliance  on  the  DoD.  These  elements  are  the  foundation  of  this  study.  The 
methodology  will  be  discussed  in  the  next  chapter. 
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ITT.  Methodology 


Chapter  Overview 

The  purpose  of  this  chapter  is  to  describe  the  methodology  used  in  this  study.  The 
purpose  of  this  research  is  to  study  HIPAA  compliance  relating  to  battlefield  medical 
evacuation.  This  study  used  the  Delphi  Method  to  address  the  research  problem.  The 
objectives  of  this  study: 

•  Define  the  major  steps  in  the  battlefield  evacuation  process. 

•  Examine  and  detennine  HIPAA  compliance  at  each  step  of  the  Battlefield 
Evacuation  model. 

•  Determine  a  recommended  approach  to  HIPAA  compliance  at  each  step  of  the 
Battlefield  Evacuation  model  based  upon  the  opinion  of  multiple  experts. 


Delphi  Method 

This  study  used  the  Delphi  Method  to  address  the  research  problem.  Delphi 
Studies  where  developed  by  the  RAND  Corporation  for  the  US  Air  Force  as  a  method  of 
forecasting  solutions  to  strategic  military  problems.  It  is  a  method  for  utilizing  the 
expertise  of  a  group  of  experts  while  minimizing  the  negative  aspects  of  group 
interactions  by  eliminating  the  need  for  physical  interaction  among  the  group  members. 

It  is  intended  to  “obtain  the  most  reliable  consensus  of  opinion  of  a  group  of  experts” 
(Dalkey  &  Helmer,  1963).  It  uses  a  series  of  questionnaires  and  controlled  opinion 
feedback  (Fowles,  1978;  Rowe  and  Wright,  1999). 

The  panel  of  experts  for  this  study  was  comprised  of  HIPAA  and  Privacy  officers, 
Civilian  HIPAA  expert  from  a  major  university,  Emergency  Room  personnel,  and 
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medical  readiness  specialists.  The  Delphi  study  questionnaire  was  developed  from  the 
results  of  the  literature  review  and  initial  interviews  of  medical  personnel.  The  Delphi 
Study  and  the  panel  selection  process  are  discussed  in  greater  depth  later  in  the  chapter. 

Initial  Model 

A  conceptual  model  of  the  Battlefield  Evacuation  process  was  developed  from 
information  gleaned  from  unstructured  interviews.  The  literature  review  and 
unstructured  interviews  with  medical  personnel  were  part  of  the  initial  study  to  help 
develop  the  battlefield  evacuation  model  and  determine  the  questions  for  the  Delphi 
Study.  The  model  was  matured  and  validated  with  the  Delphi  Study  panel. 


Panel  Selection 

The  selection  of  qualified  panel  members  was  determined  during  unstructured 
data  gathering  interviews  which  were  conducted  to  determine  the  exact  route  the  study 
would  take.  The  panel  members  were  Active  Duty  and  Civilian  Air  Force  medical 
personnel,  an  Active  Duty  Army  surgeon,  and  a  civilian  university  professor.  Subjects 
were  selected  based  two  factors:  HIPAA  knowledge  and  Deployed  medical  experience. 
The  criterion  for  individual  selection  for  deployment  was  at  least  one  deployment  to  a 
combat  theater  of  operations  in  the  last  three  years  in  a  medical  capacity.  For  selection 
based  on  HIPAA  knowledge  the  criteria  was  extensive  knowledge  of  HIPAA  in  a 
military  medical  environment.  During  these  interviews  each  member  was  asked 
deployment  and  HIPAA  experience  both  deployed  and  in  garrison.  Those  which  met  the 
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criteria  were  asked  to  be  panel  members.  Two  civilian  HIPAA  experts  were  on  the  panel. 
One  of  whom  is  a  university  professor  who  served  on  a  HIPAA  advisory  committee  to 
congress  when  the  law  was  drafted.  The  military  members  are  emergency  room  and 
deployment  readiness  experts  who  have  extensive  medical  experience  in  a  deployed 
environment.  These  are  personnel  who  each  have  multiple  deployments  to  medical 
facilities  in  the  Iraqi  and  Afghanistan  Theaters  of  operations  and  have  been  involved  with 
HIPAA  compliance  while  deployed.  While  selecting  the  panel  members  every  attempt 
was  made  to  have  at  least  one  expert  in  each  of  the  areas  studied.  Experience  in  multiple 
areas  or  all  areas  of  interest  was  highly  desired  in  each  participant,  but  not  realistic,  in 
practice,  for  every  member  of  the  panel. 

Delphi  Research  Protocol 

The  follow  protocol  was  developed  to  guide  the  Delphi  study: 

Stage  One:  Build  model  of  Battlefield  Medical  Evacuation  process  with  experts 
Round  One 

Create  model  of  Evacuation  process 

Conceptual  model  developed  from  unstructured  interviews  with  medical  and 
deployment  experts. 

Round  Two 

Refine  model  with  help  of  experienced  experts 
Create  first  round  Delphi  Questions 

o  Test  run  questions  for  clarity  to  non-Delphi  individuals 

Stage  Two:  Mature  and  Validation  of  Model  with  Delphi  Study  panel 
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Round  one 


The  model,  cover  letter,  HIPAA  overview,  and  Delphi  questions  distributed  to  all 
team  members. 

Questions 

o  Q 1  In  General  do  you  agree  with  the  model? 
o  Q2  Do  you  have  any  change  to  make  to  the  model? 
o  Q3  How  does  HIPAA  apply  at  each  stage? 


End  of  Round 

Consolidate  and  de-conflict  answers  for  the  group  and  question  if  necessary  on 
areas  of  dispute  or  wide  variance.  If  no  disputes,  proceed  to  round  two. 


Round  Two 

Questions  (possible) 

o  Q 1 .  Which  model  do  you  think  best  reflects  what  is  being  done  in  theater? 
2a  or  2b? 

o  Q2.  Given  the  model  you  chose,  do  you  have  any  further 
recommendations  for  change  to  the  model? 
o  Q3  What  are  your  recommendations  to  better  implement  HIPAA  at  each 
stage  of  the  model? 

End  of  Round 

Consolidate  and  de-conflict  answers  for  the  group.  If  necessary,  perform  one  last 
round  of  to  clarify  and  refine  responses 


Round  One 

Before  Round  One,  the  model  and  questions  were  pilot  tested  on  2  individuals 
within  the  GIR  program.  The  model  and  questions  were  found  to  be  clear  with  only  a 
few  minor  changes. 
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At  the  start  of  Round  One,  the  questionnaire  package  was  emailed  to  each 
participant  and,  in  addition,  a  copy  was  hand  delivered  to  each  local  panel  participant. 

The  questionnaire  consisted  of  the  conceptual  model  and  questions.  The  package 
consisted  of  two  MS  Excel  documents  and  One  MS  Word  document.  The  cover  letter 
explained  the  purpose  of  the  study  and  included  a  DoD  HIPAA  fact  sheet  which 
explained  HIPAA  from  a  military  perspective.  Each  participant  was  asked  to  examine 
the  model  and  answer  three  questions.  First,  each  participant  was  asked  if  they  in  general 
agreed  with  the  model.  Second,  each  participant  was  asked  if  they  had  any  changes  to 
model.  Finally,  each  participant  was  asked  how  HIPAA  applies  at  each  step  of  the  model. 
Eight  surveys  were  sent  out  and  seven  were  returned  over  a  three  week  period.  The 
analysis  of  Round  One  is  described  in  greater  detail  in  Chapter  IV. 

Round  Two 

For  Round  Two,  the  model  was  modified  to  incorporate  individual  participant 
responses.  The  Round  One  responses  resulted  in  the  creation  of  two  models  to  reflect  the 
differences  in  inputs  received  from  the  panel.  A  summary  of  the  Round  One  response  for 
each  question  was  included  in  the  Round  Two  package.  The  complete  questionnaire 
package  (See  Appendix  B)  for  Round  Two  included  a  brief  cover  letter,  a  summary  of 
Round  One  responses,  two  models  of  the  battlefield  medical  evacuation  process,  and 
three  new  questions.  The  package  was  distributed  the  same  as  Round  One;  it  was 
emailed  to  all  participants  and  hand  delivered  to  local  participants.  The  each  participant 
was  asked  to  pick  the  model  they  felt  best  represented  how  HIPAA  was  implemented. 
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They  were  then  asked  if  they  had  any  additional  changes  to  the  model  they  chose. 

Finally,  each  participant  was  asked  to  what  should  be  done  to  better  implement  HIPAA  at 
each  step  of  the  model.  Eight  Surveys  were  sent  out  and  five  were  returned  over  a  two 
period.  The  analysis  of  Round  Two  is  described  in  greater  detail  in  Chapter  IV. 

Summary 

The  results  of  the  Delphi  panel  were  analyzed  and  two  final  models  were  created. 
Each  participant’s  responses  were  analyzed  and  summarized.  Recommendations  were 
made  based  on  the  analysis  of  study  results  and  the  models  revised  to  reflect  the  analysis 
performed  in  Chapter  IV.  Future  research  Topics  are  identified  in  Chapter  V. 
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IV.  Findings  and  Analysis 


Overview 

Analysis  of  the  questionnaires  has  been  summarized  and  is  presented  in  the  first 
part  of  this  chapter  as  a  summary  of  results.  General  comments  have  been  incorporated 
into  this  summary,  with  specific  comments  used  to  illustrate  key  points.  The  Delphi 
Study  was  conducted  in  two  rounds. 

Summary  of  Results 

The  Delphi  Panel  initially  consisted  of  eight  members  with  one  not  responding  to 
the  first  round  questionnaire  (Appendix  A),  leaving  seven  members  who  responded.  The 
Afghanistan  member  of  the  panel  did  not  respond  until  after  Round  Two  had  been  sent 
out.  He  was  counted  as  one  of  the  seven  respondents.  His  comments,  while  too  late  to  be 
included  in  the  Round  two  models,  were  considered  important  as  he  was,  as  of  the  time  of 
this  study,  deployed  to  the  Afghanistan  theater  of  operations  at  the  Army  Combat  Support 
Hospital  (CSH).  His  overall  responses  did  not  change  the  general  consensus  of  the 
answers  given  by  group  but  did  bring  to  attention  the  differences  in  the  evacuations 
models  for  Iraq  and  Afghanistan.  His  responses  will  be  discussed  in  more  depth  later  in 
this  chapter. 

Round  One 

Round  one  of  the  Delphi  study  was  sent  out  to  the  panel  with  the  model  created 
during  the  investigative  phase  of  the  study  (See  Figure  1  below).  The  Round  one 
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questionnaire  consisted  of  three  questions.  Two  questions  evaluated  the  Battlefield 
Evacuation  Model  and  one  open  ended  question  intended  to  establish  the  current  level  of 
HIPAA  compliance  at  each  step  of  the  model.  The  following  Round  one  questions  were 
asked: 

Q 1 .  In  general  do  you  agree  with  the  model? 

Q2.  Do  you  have  any  changes  to  the  model? 

Q3.  How  does  HIPAA  apply  at  each  step? 

Of  the  seven  members,  all  responded  to  all  questions  and  provided  responses. 
Comments  were  summarized  and  incorporated  into  the  second  round  questionnaire  into 
two  new  models.  Individual  replies  were  consolidated  and  analyzed  for  consensus.  All 
(100%)  seven  members  of  the  panel  had  consensus  on  Question  one,  indicating  they 
agreed  with  the  model  in  general.  Question  two  asked  for  any  changes  to  the  model. 
There  were  no  contradictory  answers  given  to  this  question.  However,  several  members 
indicated  missing  steps  on  the  model.  Five  out  of  seven  respondents  noted  the  same 
omissions  on  the  model.  The  changes  and  additional  steps  were  incorporated  into  the  new 
models  for  round  two.  The  responses  to  question  three  were  divided  between  full 
compliance  and  partial  compliance.  This  division  spawned  two  models  for  round  two 
reflecting  the  split  in  opinions  (See  Figures  2  and  3). 
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Figure  1.  Initial  Model 
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Figure  2.  Round  Two  Model  2a  "Full  Compliance' 
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Figure  3.  Round  Two  Model  2b  "Partial  Compliance' 


The  Afghanistan  member  of  the  panel  noted  on  Q1  that  the  model  did  not  allow 
for  the  differences  between  Iraq  and  Afghanistan  but  in  general  it  represented  the 
“general  scheme  of  things”  and  that  operational  situations  may  dictate  changes  to  the 
flow  of  the  model.  On  Q2  he  stated  the  Afghanistan  evacuation  process  is  very 
compressed  compared  to  the  Iraq  model.  In  Afghanistan,  the  Forward  Surgical  Teams 
(FST)  were  split  in  half  and  are  co-located  with  Battalion  Aid  Stations  on  small  forward 
bases  along  the  Pakistan  border.  The  CSH  in  Afghanistan  is  also  the  Theater  Hospital 
and  the  Contingency  Aeromedical  Staging  Facility  (CASF)  and  the  patients  are  evacuated 
straight  to  the  OCONUS  step  of  the  evacuation  model.  This  was  a  surprise  finding  due  to 
the  fact  that  up  to  this  point  in  the  study,  all  research  suggested  that  the  Iraq  and 
Afghanistan  theaters  of  operations  were  the  same  and  from  an  evacuation  perspective,  the 
same  theater  of  operations.  Most  of  the  panel  members  had  only  been  deployed  to  the 
Iraq  or  Kuwait  theater  of  operations  and  apparently  were  unaware  of  the  differences. 
These  findings  prompted  the  creation  a  separate  model  to  reflect  the  Afghanistan 
battlefield  medical  evacuation  procedures  (See  figure  4  below).  In  response  to  Q3,  the 
patient  documentation  relating  to  care  and  evacuation  for  the  CSH  is  entered  and  stored 
in  a  secured  clinical  database  which  makes  it  easier  to  be  tracked  by  all  authorized 
parties.  On  the  ground,  the  commanders  are  made  aware  of  all  pertinent  medical 
information  that  affects  the  mission  capabilities  of  his/her  soldiers  and  unit.  The  system 
has  security  and  privacy  element  built  in.  The  security  and  privacy  elements  help  meet 
HIPAA  requirements,  but  according  to  the  panel  member  the  system  is  focused  primarily 
on  operational  security. 


24 


Afghanistan  Theater  of  Operations 
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Figure  4.  Afghanistan  Model 

The  secure  clinical  database  mentioned  in  Q3  by  the  Afghanistan  panel  member 
was  another  change  to  the  Afghanistan  theater  of  operations.  Further  research  discovered 
that  the  system  is  called  The  Medical  Communications  for  Combat  Casualty  Care  (MC4) 
and  it  was  deployed  at  Bagram  AB  Afghanistan  in  November  2007  and  additional 
deployments  planned  in  Iraq.  According  to  the  MC4  website  (2008)  when  the  system  is 
fully  implemented  it  will  allow  medical  information  to  gathered,  tracked,  and  transferred 
electronically  from  the  battlefield  point  of  injury  throughout  the  evacuation  process  all 
the  way  back  to  CONUS.  MC4  is  meets  all  HIPAA  privacy  and  security  requirements 


25 


making  it  a  very  powerful  tool  for  protecting  PHI  (Steen,  2007).  MC4  was  not  within  the 
scope  of  the  study. 

Round  Two 

The  second  round  of  the  Delphi  study  (See  Appendix  B  for  full  package)  was  sent 
to  all  eight  of  the  original  panel  members.  Three  members  of  the  panel  did  not  respond. 
The  second  round  consisted  of  a  summary  of  the  answers  to  the  round  one  questions,  two 
new  models  of  the  evacuation  process,  and  three  new  questions.  Questions  Q1  and  Q2 
relate  to  how  HIPAA  is  currently  implemented  and  refers  to  Models  2a  and  2b  (See 
Figures  2  and  3  above).  Question  Q3  relates  to  recommendations  for  future 
improvements  to  HIPAA  compliance.  The  following  questions  were  asked: 

Q 1 .  Which  model  do  you  think  best  reflects  what  is  being  done  in  theater?  2a  or 
2b 

Q2.  Given  the  model  you  chose,  do  you  have  any  further  recommendations  for 
change  to  the  model? 

Q3.  What  are  your  recommendations  to  better  implement  HIPAA  at  each  stage  of 
the  model? 

All  members  of  the  panel  selected  Model  2b,  which  had  partial  compliance  in 
steps  1  thru  6  and  full  compliance  in  steps  7  thru  9.  One  panel  member  had  further  minor 
changes  to  the  model.  The  changes  to  the  model  suggested  by  the  single  member  were 
implemented  into  the  final  model  as  they  were  relatively  minor,  improved  the  accuracy, 
and  did  not  change  the  spirit  of  the  model  (See  Figure  5  below). 
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|  Final  Battlefield  Medical  Evacuation  Model  | 
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This  model  is  intended  to  show  the  longest  path  of  the  Battlefield  Medical  Evacuation  process  and  to  generally  represent  the  evacuation  process. 

The  model  is  not  intended  to  show  any  particular  thea 

operations  or  is  it  intended  to  represent  the  experiences  of  any  particular  patient.  Each  location  in  the  model  may  do  the  functions  of  several  ste| 

For  example  the  CSH  in  Afghanistan  is  also  the  theater 

Ithe  CASF.  The  transport  steps  represent  patient  movement  between  the  various  steps  of  the  model  and  not  necessarily  patient  movement  between  locations.  1 

i  n 

*  Critical  Care  Air  Transport  Team  (CCATT)  -  Usually 
pickup  patients  at  an  ICU  or  OR  at  Steps  3,4,6,  and  8 
and  will  deliver  to  Step  10  .  Will  only  pickup  from 
CASF  if  stable  patient  crashes. 

**Contingency  Aeromedical  Staging  Facility  (CASF)  -  Usually  co¬ 
located  with  Theater  Hospital.  Recieves  patients  for  theater 
hospital  and  prepares  patients  for  transport  from  theater 
hospital.  Destination  depends  on  location  of  CASF. 

1 

FST  -  Field  Surgical  Team 

LRMC  -  Landstuhl  Regional  Medical  Center 

MFST  -  Air  Force  Mobile  Field  Surgical  Team 

Figure  5.  Final  Model 


Question  three  asked  for  recommendations  to  better  implement  HIPAA  at  each 
stage  of  the  model.  Several  suggestions  were  offered  by  the  panel  and  mainly  centered 
on  administrative  fixes  such  as  “Clear  written  guidance”,  “Cover  letters”,  and  “Education 
to  field  medics.”  One  of  the  panel  members  noted  that  full  compliance  with  HIPAA  is 
probably  somewhat  budget  constrained  as  full  compliance  would  require  additional 
resources  of  people  and  equipment. 

Summary 

The  responses  to  the  Delphi  Rounds  suggest  that  there  is  a  common  perception 
among  the  Delphi  Panel  members  that  HIPAA  compliance  is  partially  in  place  throughout 
the  evacuation  process.  The  panel  recommendations  are  entirely  administrative  in  nature 
and  complimentary  to  each  other.  Chapter  V  presents  a  discussion  of  the  findings, 
conclusions  of  the  study  and  recommendations  for  change. 
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V.  Conclusions  and  Recommendations 


Discussion 

In  the  first  round  of  the  study  all  participants  were  in  agreement  except  to  how 
much  HIPAA  should  be  implemented.  The  third  question  asked  each  participant  “How 
does  HIPAA  apply  at  each  step?”  The  basic  breakdown  of  responses  was  that  several  of 
the  participants  felt  that  HIPAA  was  partially  implemented  at  each  step  and  a  few  others 
said  that  HIPAA  was  fully  implemented  in  each  step.  As  noted  earlier,  this  difference 
prompted  the  creation  of  two  models  for  Round  Two.  There  may  have  been  confusion 
with  the  question,  because  during  Round  Two  of  the  study  when  asked  which  model  best 
represents  how  HIPAA  is  currently  implemented  all  respondents  chose  Model  2b  (Partial 
compliance).  This  suggests  a  possible  disconnect  on  how  the  respondents  interpreted  the 
questions.  The  responses  suggest  that  some  participants  may  have  interrupted  the 
question  as  “How  is  it  being  done”  and  some  interrupted  it  as  “How  is  it  supposed  to  be 
done.”  In  all  cases  the  responses  said  that  patient  care  took  the  precedence  over 
administrative  requirements. 

When  asked  to  provide  suggestions  for  improvements  in  how  HIPAA 
requirements  are  implemented  the  panel  gave  a  range  of  administrative  responses:  Clear 
written  guidance,  training  and  clearly  marked  cover  sheets. 

One  of  the  issues  mentioned  by  various  members  of  the  panel  during  the  study 
was  unauthorized  requests  for  patient  infonnation  from  unit  members  and  high  ranking 
military  members.  The  study  suggests  that  when  these  requests  come  in  the  lack  of 
written  guidance  put  an  extra  burden  on  the  medical  personnel  because  they  don’t  have 
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clear  written  operating  instructions  to  fall  back  on.  It  is  not  inconceivable  that  a  low 
ranking  military  member  could  be  approached  for  patient  PHI  by  a  high  ranking  military 
member  or  even  a  member  of  congress.  The  pressure  felt  to  release  the  requested 
information  would  likely  be  immense.  Without  clear  written  guidance  to  reference,  the 
member  would  have  to  rely  upon  the  support  of  their  chain  of  command  to  ensure  they 
didn’t  release  patient  PHI  to  unauthorized  individuals.  If  the  individual  released  the 
requested  PHI  to  an  unauthorized  person  then  they  have  violated  HIPAA  and  could 
conceivability  find  themselves  facing  legal  and  financial  penalties.  Another  and  more 
frequent  source  of  unauthorized  requests  for  patient  PHI  comes  from  the  members  of  the 
patient’s  unit. 

When  a  member  of  a  unit  is  wounded  in  the  course  of  a  mission,  it  is  only  natural 
his  or  her  buddies  will  likely  want  to  know  the  status  of  their  team  mate.  Under  current 
HIPAA  policy,  these  unit  members  are  not  one  of  the  authorized  categories  authorized  to 
receive  this  information  without  the  patient’s  pennission.  The  responses  from  the  panel 
suggest  the  morale  of  the  remaining  members  of  the  wounded  individual’s  unit  should  be 
taken  into  account,  and  that  the  current  practice,  especially  at  the  initial  steps  of  the 
model,  is  to  provide  at  least  minimal  infonnation  to  the  unit  members.  In  many  cases,  the 
bonds  between  unit  members  in  a  combat  are  as  strong  as  if  they  were  family  members. 
The  moral  of  a  unit  could  be  affected  by  the  denial  of  status  information  for  the  fallen 
team  mate  and  could  affect  perfonnance  in  coming  missions. 

HIPAA  policy  allows  commanders  and  their  designees  to  ask  for  information 
regarding  the  status  of  personnel  under  them,  but  is  limited  to  PHI  in  the  interests  of 
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fitness  for  duty  and  to  perfonn  a  mission.  There  are  other  individuals  who  may  have  an 
interest  in  PHI  in  a  combat  situation,  other  than  the  commander,  and  who  may  not  be  a 
“designee”  and  probably  do  not  have  access.  In  addition  to  moral  factors,  the  health 
information  could,  in  combat,  be  critical  to  squad  leaders,  platoon  leaders,  flight  leaders, 
or  anyone  else  who  might  not  fit  the  definition  of  "commander".  They  would  certainly  be 
concerned  about  the  person,  but  would  need  to  know  "information"  for  replacement  of  a 
skill  set,  to  protect  others,  or  to  assess  readiness.  They  may  need  to  know  the  person’s 
status  to  know  if  the  person  will  return  or  if  they  will  need  to  request  a  replacement.  A 
unit  missing  critical  skills  sets  could  be  at  a  disadvantage  when  operating  in  the  field. 

This  issue  could  impact  the  mission  readiness  of  combat  units  and  may  need  to  be 
addressed  in  the  future.  The  policy  may  need  to  be  looked  at  as  to  allow  for  some 
information  on  patient  condition  to  be  legally  given  to  unit  members  on  the  basis  of 
morale  concerns  as  this  may  impact  readiness  of  combat  units. 

All  members  of  Delphi  Panel  chose  a  model  of  partial  compliance  in  the  combat 
theater  of  operations  not  one  of  full  compliance.  Current  practice  suggests  that  having 
freedom  of  motion  in  complying  with  HIPAA  during  combat  seems  to  be  working  well 
according  to  the  Delphi  panel.  While  current  interpretation  of  HIPAA  policy  does  not 
appear  to  be  full  compliance  on  the  battlefield  itself,  it  may  be  worth  in  the  future  to  look 
at  how  the  policy  can  be  written  to  fit  how  things  are  actually  need  to  be  done.  For 
example,  unit  members  who  may  be  giving  medical  aid  at  the  front  are  exempt  from 
HIPAA  until  the  wounded  reaches  the  BAS.  Once  at  the  BAS,  unit  chain  of  command 
can  get  status  and  fitness  for  duty  information,  and  they  would  then  have  authority  to 
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release  to  unit  members.  Unit  members  may  receive  basic  status  infonnation  such  as  will 
they  live  and  whether  the  wounded  members  return.  Once  the  wounded  is  at  the  CSH, 
status  and  fitness  for  duty  infonnation  could  be  given  to  the  unit  commander’s  and  down 
to  the  squad  leader  level.  Once  a  Policy  needs  to  be  examined  to  bring  it  in  line  with 
what  is  being  done.  While  current  interpretation  of  HIPAA  policy  does  not  appear  to  be 
full  compliance  on  the  battlefield  itself,  it  may  be  worth  in  the  future  to  look  at  how  the 
policy  can  be  written  to  reflect  what  needs  to  be  done.  In  consultation  with  legal 
authorities  DoD  policy  and  HIPAA  policy  may  need  to  be  looked  at  modified  to  allow 
room  in  the  policy  for  partial  HIPAA  compliance  on  the  battlefield. 

The  issues  raised  by  the  Delphi  panel  suggest  that  the  DoD  policy  discussion  may  not 
have  completely  considered  HIPAA  implications  in  a  combat  zone.  There  are  provisions 
in  the  policy  for  fitness  for  duty,  fitness  for  a  particular  mission  and  casualty  reporting, 
but  beyond  that  it  seems  like  DoD  may  have  extended  the  HIPAA  policy  without 
thinking  it  through.  It  may  be  that  DoD  wanted  to  avoid  any  possibility  of  a  lawsuit  or 
other  legal  issue  and  may  have  extended  HIPAA  compliance  too  far  down. 

It  was  assumed  there  would  be  common  way  to  handle  battlefield  causalities  in  the 
military  medical  system  but  the  research  suggests  there  may  be  differences  in  different 
areas  of  operations.  Future  research  may  need  to  tie  down  for  sure  if  that  is  true  in  other 
cases  as  well,  and  if  so,  how  this  will  have  impact  on  how  HIPAA  is  implemented. 
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Conclusions 


There  does  seem  to  be  fairly  standard  practice  and  implementation  of  HIPAA 
policy  in  combat  areas  and  it  is  one  in  which  the  strict  interpretation  of  HIPAA  does  not 
come  in  play  until  casualties  reach  a  certain  stage  of  the  evacuation  process.  The  findings 
of  the  study  suggest  that  the  military  could,  in  consultation  with  legal  authorities,  adjust 
DoD  HIPAA  compliance  policy  at  every  level  of  the  battlefield  medical  process  to 
clearly  define  who  can  have  access  to  PHI  at  each  stage  and  under  what  conditions  that 
access  is  granted. 

If  DoD  made  these  recommended  changes  to  the  current  policy  it  could  go  a  long 
way  to  clarifying  the  requirements  placed  on  deployed  medical  personnel  at  all  level  of 
the  evacuation  model.  Clear  written  guidance  and  training  would  help  ensure  that  the 
Privacy  Rule  of  HIPAA  was  complied  with  and  help  avoid  unnecessary  and  potentially 
costly  violations  of  the  law.  The  more  the  process  can  be  clarified  for  the  medical 
personnel  all  along  the  evacuation  process  the  better  the  chance  of  full  HIPAA 
compliance  at  all  steps  of  the  process. 

Limitations 

An  Inherent  limitation  of  all  Delphi  studies  is  that  results  depend  on  the 
knowledge  of  a  small  set  of  identified  experts.  To  the  extent  that  other  experts  might  see 
things  differently,  the  conclusions  could  be  called  into  question.  The  panel  consisted  of 
Air  Force  medical  personnel,  with  primarily  Iraq  and  Kuwait  deployment  experience  and 
only  one  member  with  Afghanistan  experience  which  may  be  a  potential  limitation.  This 
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possibly  was  suggested  in  Round  One  when  the  member  in  Afghanistan  pointed  out 
difference  between  Iraq  and  Afghanistan.  Two  separate  models  were  identified  for  Iraq 
and  Afghanistan  but  single  member  of  panel  from  Afghanistan  did  not  provide  any 
recommendations  for  improvement  to  Afghanistan  model. 

Recommendations  for  Future  Research 

Now  that  a  basic  model  on  the  Battlefield  Medical  Evacuation  process  with 
HIPAA  compliance  at  each  step  has  been  identified,  additional  research  could  be  done  to 
validate  the  findings  and  look  at  areas  beyond  the  scope  of  this  study. 

The  panel  consisted  of  Air  Force  medical  personnel  with  primarily  Iraq  and 
Kuwait  deployment  experience.  One  member  was  knowledgeable  on  Afghanistan,  due  to 
past  and  current  deployment  experience.  This  study  could  be  applied  using  members  of 
services  other  than  the  Air  Force  to  explore  the  possibility  that  medical  personnel  for  the 
Army,  Navy  and  Marines  view  the  evacuation  process  differently. 

This  study  assumed  there  would  be  a  common  way  to  handle  battlefield 
causalities  in  the  medical  system,  but  there  is  strong  evidence  from  the  research  to 
suggest  there  may  be  differences  in  different  areas  of  operations.  The  study  identified 
differences  between  Iraq  and  Afghanistan,  and  future  research  should  explore  the 
significance,  if  any,  of  this  finding.  Questions  to  study  might  be:  Will  there  be  other 
models  for  other  theaters  of  operations?  Is  it  appropriate  to  have  multiple  models? 

Many  individuals  with  the  military  community,  but  outside  the  medical  field  must 
have  access  to  patient  PHI.  A  recommendation  is  made  to  conduct  research  on  the  many 
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non-medical  personnel  who  may  have  a  need  to  have  access  to  HIPAA  infonnation,  such 
as  commanders  and  their  designees,  in  order  to  identify  how  these  non-medical  personnel 
think  the  process  should  be  conducted.  A  specific  question  to  study  might  be:  Is  the 
current  process  meeting  their  needs? 

It  would  also  be  interesting  to  explore  this  issue  from  a  legal  standpoint  to  ensure 
that  solutions  meet  legal  requirements,  as  especially  as  this  study  was  conducted  entirely 
without  input  from  the  legal  community.  The  legal  community  will  likely  have  to  be 
involved  in  any  solution  brought  forth,  because  the  solution  will  have  to  meet  all 
applicable  HIPAA  legal  requirements.  The  legal  community  is  best  equipped  to  provide 
the  legal  knowledge  and  expertise  needed  to  ensure  compliance  and  avoid  legal  pitfalls 
which  could  derail  any  proposed  solution. 
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14.  ABSTRACT 

The  purpose  of  this  research  was  to  examine  the  impact  of  HIPAA  compliance  on  the  Battlefield  Medical  Evacuation  process. 
Specifically,  this  thesis  sought  to  answer  three  research  questions  addressing  the  current  Battlefield  Medical  Evacuation  process 
and  current  HIPAA  considerations  for  each  step  of  the  process.  The  research  questions  were  answered  through  the  use  of  the 
Delphi  Technique.  Eight  experts,  representing  Air  Force,  Army  and  Civilian  medical  communities  participated  in  two  rounds  of 
the  Delphi  Technique.  The  research  identified  how  HIPAA  compliance  is  handled  now  and  identified  suggested  improvements. 

An  original  model  of  the  battlefield  medical  evacuation  process  was  developed,  and  this  was  presented  to  the  Delphi  group  for 
changes  and  acceptance.  The  group  was  then  tasked  to  identify  the  application  of  the  HIPPA  requirements  at  each  stage  of  the 
model.  The  final  model  suggests  that  partial  HIPAA  compliance  is  the  current  trend  in  the  early  steps  of  battlefield  medical 
evacuation.  The  culmination  of  this  effort  was  the  development  of  recommended  improvements  based  upon  the  suggestions  of 
knowledgeable  people.  The  suggested  improvements  were:  clear  guidance,  training  and  additional  resources. 

The  study  may  help  Commanders  prepare  themselves  and  their  personnel  to  handle  HIPAA  information  in  a  deployed 
environment. 
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